Solved User Accounts

[VistaKing]

What account are you logged in on ?

 

[tyler4402]

On the welcome screen are 2 icons, which are Administrator and the account I use with my picture on it, : it is Robert Standard User

 

[VistaKing]

Click on Administrator ( no password ) then try to add your account to the Administrators group .

Open up an Elevated Command Prompt. Click on rb: in

type CMD . Right click on CMD under Programs (1) choose

. On the User Access Control window click on the Yes button . Command Prompt opens up to C:\Windows\System32>_

Inside Command Prompt type the command below

net localgroup Administrators Robert /add

and press Enter

 

[tyler4402]

Hi again, my reply to you of Saturday seems to be missing, so I will update you, that last CMD seemed to do the trick and I have command of my programs again & the User Accounts show Administrator/Administrator and Robert/Administrator, which I use and do not have to use my PW which is good.
Everything seemed to work Ok on Saturday & the PC shut down, started, and rebooted as it should, Unfortunately the shutdown problem that appeared has returned, although the PC did take a couple of mins to shut down before we started the repair.
Last night I had my "Silent Hunter3 " running for a few hrs, and when I clicked Shutdown nothing happened, I waited quite a while and then used the power switch. This morning on boot-up I got the black screen menu because the PC did not shut down correctly with the > Start in safe mode / Command Prompt/ Start Windows Normally etc, I clicked Normally and the screen went Black for 6/7 mins after which I tried pressing the Ctl+Alt+Del keys, and same as last time the PC booted and loaded Windows. My wife says that every time I use the game I have probs, but I think its coincidence as I don't think running a game should stop the PC from shutting down. Regards Robert.

 

[tyler4402]

Hi, I have not had a reply from you in 4 days and was wondering if I should do anymore scans etc? or if any of the tools you have sent will be of any use to me in the future. thanks again Robert.

 

[Layback Bear]

Hi tyler. I'm not sure I have the answers to your problem but lets try a a few things.
1. Remove all old FRST
2. Run a new FRST from administrator only.
**From your old logs.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-08-2013
Ran by Robert (ATTENTION: The logged in user is not administrator) on 23-08-2013 16:31:02
Running from I:\Users\Robert\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal
----------------------

Now complete this Tutorial by Brink and post the log here.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

 

[tyler4402]

Hi Layback Bear, thanks for your interest, whatever happened to VistaKing ? he gave me help then went quiet 5 days ago.
Anyway my thanks for your help & advise.
The PC is working better now but takes some time to shut down especially if I run my game.
By remove old FRST your telling me to delete the old FRST log files from my desk top? at the moment when I start up there are two accounts ie Admin and Robert which I click on to start windows, > 2. Run a new FRST from administrator only.
**From your old logs. not sure what you mean by this, but I can run another FRST file for you as I have the Farbar prog on my desktop.
For your info when I open "User Accounts" it now shows Robert Administrator, and when I click manage another account there are 3 shown, being Robert Administrator > Administrator, and the guest account, which is off.
In the meantime I will check out the Brink tutorial, regards Robert.

 

[Layback Bear]

This will be required to continue any farther.

Windows Genuine and Activation Issue Posting Instructions

 

[tyler4402]

Hi Layback Bear, I hope this is what you want.
An thanks Dwarf fr't distructions on step 7 I ops a got erm reight

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-B84M4-RQWQH-QRGWG
Windows Product Key Hash: 9IHF/oWUhBZvbP3ElbAImPwr0bs=
Windows Product ID: 00371-177-8001131-85320
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {F687190D-A445-4618-825B-F0EE1BE78E51}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Professional
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.130708-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: I:\Program Files\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F687190D-A445-4618-825B-F0EE1BE78E51}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-QRGWG</PKey><PID>00371-177-8001131-85320</PID><PIDType>5</PIDType><SID>S-1-5-21-3619600033-2495703809-3358291532</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>H55M-D2H</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F3</Version><SMBIOSVersion major="2" minor="4"/><Date>20100820000000.000000+000</Date></BIOS><HWID>3EBB3607018400EC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00170-177-800113-00-2057-7601.0000-1082012
Installation ID: 018831917566313446918042346521777642426824131990393003
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: QRGWG
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 30/08/2013 00:12:52
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:30:2013 18:32
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
HWID Data-->
HWID Hash Current: OgAAAAEABgABAAEAAQACAAAAAgABAAEA6GFSfZBP4l+YsnaNgJYoYELGznTaEcSWAs49bV8SxRlcXQ==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
EUDS GBT 
TAMG GBT GBT B0
SSDT INTEL PPM RCM

 

[Layback Bear]

Tyler you log has me confused. I have requested help from a friend who is a expert on such things. Hang in there it will take a little time.

 

[tyler4402]

Ok, Thanks L B

 

[Layback Bear]

Tyler your log was checked by my expert friend and things seem to be Okay.
I'm going to read through the completed thread again and see if I can pick up some ideas.

 

[Layback Bear]

Well I have found some troubling things.
Something is taking control of admin. and not allowing you to do the things needed to be done. That is normally a infection blocking you and possibly browsers also. These infections do this to stop you from getting help to remove the infection.
Things I have found.
keyscrambler.exe File Diagnosis Information - SpyDig

What Is keyscrambler.exe
The keyscrambler.exe file is a malicious file related to spyware.

driverscanner.exe Windows process - What is it?

I also found you are using IObit programs. Not a good thing. Those programs could of also took control of admin. I highly recommend never using anything from IObit. NEVER.
I also noticed you have Avast and Comodo installed at the same time.
Their are probably more that I have missed.
In my opinion the only way to be sure your computer will work the way it should would be a Clean Install. My reasoning is simple. If one takes the time to remove all this junk you would still have to fix the damage the junk has caused which could take forever and you still wouldn't really know if everything was removed and problems fixed.

Because all these infections have been in your system I recommend changing all passwords to all sites and all banking, credit card, ect.
**Their is a good chance your passwords and identification could of been stolen. **
Please remember that anything you have made or have connected to this computer could also be infected.
Example:
*Back ups
* Burnt C/D or DVD
* USB any thing such as Thumb Drives, Memory sticks, External drives, ect.
This is what I have in mind.
By Brink:
http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

Here is another option
By Greg:
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

 

[tyler4402]

Hi LB, Thanks for your time, I have only just seen post 53 so now I can explain a few things for you.

The IObit is a prog called > Smart-Defrag, I have used it for Oh must be 5 years and it works very well, although I also have Puran-Defrag which was recommended by a Tech person, and I can also use if needed, but it will have to be good to work better than Smart Defrag.

The SpyPig is an email tracking system which is not installed and the link to the SpyPig program is in my Favourites folder and I haven't downloaded it yet.

Driver Scanner is another driver update prog from Uniblue I found it in I:\ProgramData\Uniblu\ but the driverscanner folder was empty, so I zapped the Uniblue folder.

The KeyScrambler is anti Keylogger prog which starts on boot up and encripts my keystokes data, some info on it can be found here QFX Software - Anti-Keylogging Software and More

I also have > Trusteer Endpoint Protection, which was recommended by my bank, it will not let you use PW's etc which are similar to those used in your online banking.
The PC is running much better now, and I can use the programs which told me that I must be an Administrator to use them, I am suprised however that you are down on IObit as I have used it for many years. Best regards Robert.

 

[NoelDP]

IOBit software is mostly stolen Intellectual Property masquerading as legitimate.
It is also mostly pretty useless, if not actually dangerous (ASC is in the latter category).
I would recommend avoiding installing or using such software.

 

[tyler4402]

Hi Noel, thanks for the info, I have uninstalled Iobit SmartDefrag and set up Puran Defrag.
What is a ASC ?? regards Robert.

 

[Layback Bear]

Google is your friend. ASC

Advanced SystemCare Free 6/5/4/3 Download Review for Windows XP/Vista/7 - IObit

 

[tyler4402]

I have tried ASC on two occasions a long time ago, and always had some sort of problem with my PC, can't remember what they were but I always put it down to installing ASC, and I think it was quite hard to get rid of, so I will find it easy to stay away from IObit products, and as you suggest I will do a bit of research to see what people think of IObit etc. Thanks Robert.

 

[tyler4402]

The PC seems ok now so many thanks for your help, regards Robert.